1. Field
The present invention relates generally to an enhanced security context for user equipment operating in a Universal Mobile Telecommunications Service (UMTS) and/or GSM Edge Radio Access Network (GERAN) and transitioning to an Evolved UMTS Terrestrial Radio Access Network (E-UTRAN).
2. Background
A successful AKA (Authentication and Key Agreement) authentication in a UMTS third generation (3G) radio access network or in a GERAN networks using 3G AKA authentication results in a pair of shared keys, a cipher key (CK) and an integrity key (IK), for securing communications between a user equipment (UE) and the network. The shared keys may be used directly to secure the traffic between the UE and the network as in the case of UTRAN (UMTS Terrestrial Radio Access Network), or may be used to statically derive keys, e.g. KC or KC128, in the case of GERAN (GSM Edge Radio Access Network).
A compromised key may result in serious security problems until the keys are changed at a next AKA authentication. Typically, the AKA authentication is not run often due to the significant overhead required. Also, if both keys (CK and IK) are compromised, then the GERAN keys are compromised.
In UMTS/HSPA (High Speed Packet Access) deployments, some or all of functionalities of a radio network controller (RNC) and a Node B may be collapsed together into one node at the edge of the network. The RNC needs the keys for functionalities such as user plane ciphering and signaling plane ciphering and integrity protection. However, the RNC functionality may be deployed in an exposed location such as in a Home Node B in a UMTS Femtocell. Accordingly, RNC functionality deployed in possibly insecure locations providing access (including physical access) may allow the keys, CK and IK, to be compromised.
Session keys (modified version of CK and IK) may be used to lower the security risks associated with exposed RNC functionality. Techniques for providing such session keys are disclosed in U.S. Patent Application Publication No. U.S. 2007/0230707 A1.
When transitioning from a UTRAN/GERAN-based serving network to an E-UTRAN based serving network, the ability to create a root key in E-UTRAN derived from the root key of the enhanced security context in UTRAN/GERAN provides a distinct advantage as it means that it is not necessary to run an AKA in E-UTRAN to generate a root key in E-UTRAN from a key that has not been exposed outside the core network.
There is therefore a need for a technique for transitioning an enhanced security context support from a UTRAN/GERAN-based serving network to a E-UTRAN-based serving network.